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Abstract — A method for concatenating quantum error- 
correcting codes is presented. The method is applicable to a wide 
class of quantum error-correcting codes known as Calderbank- 
Shor-Steane (CSS) codes. As a result, codes that achieve a high 
rate in the Shannon theoretic sense and that are decodable in 
polynomial time are presented. The rate is the highest among 
those known to be achievable by CSS codes. Moreover, the best 
known lower bound on the greatest minimum distance of codes 
constructible in polynomial time is improved for a wide range. 

Index Terms — Polynomial time, concatenation, syndrome de- 
coding, achievable rates. 



I. Introduction 

In the past decades, great efforts have been made to extend 
information theory and its ramifications to quantum theoretical 
settings. In particular, quantum error correction has been 
an attractive field for both physicists and coding theorists. 
The most important class of quantum error-correcting codes 
(quantum codes) would be that of symplectic codes (stabilizer 
codes) [1], [2], [3]. These codes have direct relations with 
codes over finite fields satisfying some simple constraints on 
orthogonality. This has allowed us to utilize many results 
from coding theory. For example, quantum codes constructible 
in polynomial time are presented in [4] based on develop- 
ments of algebraic geometry codes. In the present paper, we 
propose a method for concatenating quantum codes, which 
will be obtained by developing Forney's idea of concatenated 
codes [5]. As applications, we will treat two complexity issues 
on quantum codes to be described below. 

The codes to be proposed in this paper fall in the class called 
Calderbank-Shor-Steane (CSS) codes [6], [7] or a closely 
related code class. CSS codes form a class of symplectic codes. 
According to [8, p. 2492, last paragraph], a CSS quantum code 
is succinctly represented as a pair of linear codes (Ci, C2) with 
C2 < Ci, where C x denotes the dual of C, and by B < C, 
we mean that B is a subgroup of an additive group C. In this 
paper, any code pair written in the form {C\, C%) is supposed 
to satisfy the constraint < C\. Note that a CSS quantum 
code is a Hilbert space associated with a code pair (C%, C2) 
in the manner described in [6] with C\ = C\ and C2 = ■ 
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However, we will keep the style [8] of not mentioning Hilbert 
spaces as far as it is possible. For the original purpose of 
quantum error correction, C\ is used for bit-flip errors and C2 
for phase-shift errors. Therefore, if codes C\ and C2 are both 
good, the CSS quantum code specified by C\ and C2 is good. 

This paper presents a method for creating code pairs, 
(Li,Li2), of relatively large lengths by concatenating shorter 
code pairs. The main technical problem to be resolved in this 
work is to concatenate code pairs in such a way that the 
resulting pair {L\,L>2) satisfies < L\. Our method for 
concatenation is applicable to any combination of a g-ary inner 
code pair, {C\,C%}, and a Q-ary outer code pair, (Di,!^), 
as far as q k = Q, where k is the number of information digits 
of the inner code pair (Ci, C2). This generality is the same as 
Forney's method has. 

Using this general method, we give solutions to two com- 
plexity issues on symplectic codes. One issue is on decoding 
complexity, and the other on complexity of code construction. 
The ability of error correction will be measured in terms of 
(i) the decoding error probability (as usual in Shannon theory) 
for the first issue, and in terms of (ii) the minimum distance 
(as usual in coding theory) for the second. Another related 
issue of construction complexity with (i) will be discussed 
elsewhere [9]. 

Regarding history of results on (i), the existence of good 
CSS codes has been proved without regard to complexity 
issues. Specifically, the rate 1 — 2h(p), where h denotes the 
binary entropy function, was called the Shannon rate in [10] 
and a proof of the achievability of 1 — 2h(p) was given in [11], 
while the achievability of a smaller rate 1 — 2h(2p), < p < 
1/2, had been known [6], Here, the channel is BSC(p), the 
binary symmetric channel of the probability of flipping bits pQ 
If a wider class of quantum codes are considered, higher rates 
are known to be achievable (e.g., by symplectic codes [12] 
or Shannon-theoretic random codes [13]). However, none of 
these codes has a rich structure that allows efficient decoding. 

In this paper, we consider the issue of constructing effi- 
ciently decodable CSS codes. By the proposed method of 
concatenation, we prove that the rate 1 — 2h(p) is achievable 
with codes for which the error pattern can be estimated in 
polynomial time. 

We remark another major approach, i.e., that of low-density 

'The asymptotically good code pairs in [6], [11] have form (C,C). For a 
more detailed description of the previous result [11], we need the definition 
of achievability in Section IIIII The above description is for the simple case 
where W\ = W2 = BSC(p) in the setting of Section fTTTl 
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parity-check or sparse-graph codes had already been taken 
to construct CSS codes [14]. However, they did not give 
asymptotically good sparse-graph quantum codes but codes 
of particular lengths around 10 4 . One of the authors [14] has 
even made a conjecture that any dual-containing sparse-graph 
codes may be asymptotically bad; note a dual-containing code 
C corresponds to a pair (C, C) in our notation. Moreover, 
the present work is different from [14] in that the decoding 
error probability is evaluated without approximation or resort 
to simulation. 

In the latter half of the paper, we will evaluate the minimum 
distance, (ii), of concatenated CSS codes that are obtained 
with our general concatenation method. The main result of 
this part (Theorem O parallels a known lower bound [15] to 
the largest minimum distance of classical constructible codes 
to some extent. 

Regarding history of results on (ii), the polynomial con- 
structibility of classical codes was formulated and discussed 
in [15], [16], [17] with the criterion of minimum distance. This 
problem formulation was brought into the realm of quantum 
coding in [4], which was followed by [18]. We will evaluate 
the asymptotic relative minimum distance of concatenated CSS 
codes produced by the proposed method, and compare these 
codes with known ones to show improvement for a wide 
range. Furthermore, a code construction known as Steane's 
enlargement of CSS codes is combined with the proposed 
concatenation method, which will turn out to be effective. 

The present work is motivated by the observation [10] (also 
described in [11], [19]) that good code pairs (Ci,C2), not 
the corresponding CSS quantum codes, are useful for quan- 
tum key distribution. We remark that for such cryptographic 
applications, we need only classical information processing, 
not quantum information processing. For example, in a well- 
known application to quantum key distribution [10], we need 
quantum devices only for modulation. 

Because of such background, the present work, in the 
previous version, used a formalism emphasizing cryptographic 
applications for presentation of results. However, the author 
follows reviewers' comments that the results should be pre- 
sented in the context of quantum error correction. Still, the 
author remarks that the main result on efficient decoding 
(Theorem [TJ applies both to quantum error correction and to 
communication over wiretapped channels. Note that decoding 
(recovery operation) for a quantum code is given as a com- 
pletely positive linear map, which is surely beyond classical 
information processing, and even if one could find some non- 
CSS-type quantum codes with efficient recovery operation, it 
would not imply Theorem Q] which claims that decoding of 
codes, L1/L2 and L2/L1, is classical information processing 
of polynomial complexity. 

The present paper was originally prepared as two seperate 
manuscripts to treat the two issues respectively, but they have 
been merged due to a request of the associate editor. We 
remark that the part treating the issue on minimum distance, 
starting from Section [X] can be read independently from 
Sections llV-Bl to HXl which treat the issue on decoding. 

The remaining part of this paper is organized as follows. In 
Section HH we fix our notation. In Section Hill a main statement 



on efficient decoding is presented. In Section |IV] concatenated 
CSS codes are defined. In Sections [VT - tVIIIl a method for 
decoding is described. Specifically, a decoding strategy is 
described in Section [V] a needed fundamental lemma is 
given and proved in Section |VT] and IVHI respectively, and 
syndrome decoding for concatenated CSS codes is described 
in detail in Section IVIIII The statement in Section [ill] is 
proved in Section |IX] In Section [X] moving to the topic on 
(ii), a useful metric for quotient spaces is reviewed. A basic 
lemma on the minimum distance of concatenated CSS codes 
is presented in Section |XI] and a general lower bound on 
the minimum distance is given in Section IXIII A restricted 
but more concrete bound is derived from the general one 
in Section IXIII to show an improvement in Section |XI11 
In Section IXIVI Steane's enlargement is combined with the 
concatenation method. Section IX VI contains a summary. 



II. Notation and Terminology 

The set of consecutive integers {1,1 + 1, ... , m} is denoted 
by [l,m]. We use the dot product defined by (x\ , . . . , x n ) ■ 
(yi,...,y n ) = J2i=i x tVi on where F is a finite field. 
For a subspace C of F n , C denotes the usual dual {y 6 F™ | 
\/x £ C, x-y = 0}. Similarly, C ±s denotes the dual {y e F 2 " j 
Vx <E C, f s (x,y) = 0} of C with respect to the symplectic 
form f s defined below. A subspace C of F™ is called an [n, k] 
code if k = log| F | \C\. As usual, [a\ denotes the largest integer 
a' with a' < a, and \a] = — [ — aj . The transpose of a matrix 
A is denoted by A t . The juxtaposition of vectors x±,...,x n 
from a linear space is denoted by (2:1 1 • • • \x n ). Throughout, 
we fix a finite field F g of q elements, and construct codes over 
F,. 

In the sense of [8], an [[n, k]] symplectic quantum code (also 
known as a stabilizer code) can be viewed as a subspace of F 2 " 
that contains its dual with respect to the standard symplectic 
bilinear form f s defined by 

fs((«ark»)) ( v x\v z )) = u x ■ v z - u z ■ v x . 

Such an (n + A:) -dimensional subspace may be called an f s - 
dual-containing code, but will be called an [[n, k]} symplectic 
code (over ¥ q ) for simplicity in this paper. 

We can also characterize symplectic codes with their gener- 
ator matrices [8]. Namely, the subspace spanned by the rows 
of a full-rank matrix of the form Q = [G x G z ], where G x and 
G z are (n + k) x n matrices, is a symplectic code if G x and 
G z satisfy 

H X G\ — H Z G X = O 

for some (n — k) x 2n full-rank matrix TL — [H x H z ] such 
that span7i < spanCJ. Here, O denotes the zero matrix, and 
span A denotes the space spanned by the rows of A. The space 
span7Y is the f s -dual of spanC*. 

We can say [8] that the CSS code construction [6], [7] is 
to take classical codes C\ and C2 with C-j 1 < C2, and form 



Q = 



O 



O 

Go 



n = 



H 2 

o 



o 

Hi 



(1) 



where Gi and Hi are the classical generator and parity check 
matrices of Ci. 
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We call a pair of linear codes (Ct, C 2 ), where C\, C 2 < F" 
satisfying the CSS constraint 



and 



k = dim Ft , C\ + dim Wa C 2 



(2) 



(3) 



an [[n, k]) code pair over ¥ q . The corresponding [[n, k}] 
symplectic code is called an [[n, k]] CSS code and is denoted 
by S css (Ci, C 2 ). 

The following slight generalization of linear codes is useful 
for our argument. While we usually use a linear code, i.e., 
subspace of F™, we also call an additive quotient group C/B 
a code (B < C < F"). If we need to distinguish codes of 
the form C/B from ordinary linear codes, we will call C/B 
a quotient code over F 9 

Using the structure of C/B explicitly is especially useful 
for describing correctable errors of quantum error-correcting 
codes. It is known that if the above code span Q is T-correcting 
(i.e., if y — x span Q for any x, y S T with x ^ y), 
then the corresponding quantum error-correcting code is A- 
correcting for A consisting of the quantum error patterns 
represented by the vectors in T + spanTi. (This form of the 
basic fact can be found in [12, Lemma 2].) Note that the set 
r + span7Y C ¥ 2 q n is formally the same as the correctable 
errors of the fictitious quotient code span C7/span7i, which is 
also called a symplectic code. 

For the CSS construction, the set of correctable errors 
r + span7Y can be written typically as follows. If (7, is J r 
correcting, by (Q3, we can set 

T + spanW 

= {(x|z) I x G Ji + span H 2 and z e J 2 + span Hi} 
= {(x\z) \ x£Ji+C 2 L and z e J 2 + Ct}. (4) 

The number k/n is called the (information) rate of the code 
pair (d, C 2 ), and equals that of Cx/C 2 and that of C 2 /Ct- 
The condition (O is equivalent to that Ct and C 2 are 
orthogonal to each other. Here, with two codes C and C 
given, we say C is orthogonal to C and write 

c ±c 

if x ■ y = for any x € C and y € C. Note that C _L C if 
and only if (iff) C <C ± , or equivalently, iff C < C' L . 

III. Theorem on Efficient Decoding 
A. Main Theorem on Efficient Decoding 

The first goal in this paper is to find a code pair (Li, L 2 ) 
such that both Lx/L^ and L 2 /Lt have small decoding error 
probabilities and are decodable with polynomial complexity. 

In particular, we will explore the achievable rates of effi- 
ciently decodable quotient codes. Here, given a sequence of 

2 The quotient codes can really be used for transmission of information in 
the following manner. The sender encodes a message into a member c of 
C/B, chooses a word in c at random and then sends it through the channel. 
Clearly, if C is J-correcting (J C F") in the ordinary sense, C/B is (J+B)- 
correcting (since adding a word in B to the 'code-coset' c does not change 
it). This kind of schemes had been known to be useful for coding on wiretap 
channels [20]. 



code pairs {(Li^, L 2 ,„) = (Li,L 2 )} and a pair of memory- 
less additive channels (WijWa), we say {(Li,L 2 )} achieves 
a rate R for (Wi, W2) if the rate of Lx/L^ approaches R and 
the decoding error probability of Lx/L^ and that of L 2 /I/^ L 
both go to zero; a memoryless additive channel W actually 
denotes the channel specified by a probability distribution W 
on ¥ q ; this channel changes an input a G ¥ q into b with 
probability W(b — a). The first half of this paper is devoted 
to proving the following theorem. 

Theorem 1: Assume we are given a pair of memoryless 
additive channels W\, W 2 , and we have a sequence of [[n, k]] 
code pairs (Ci,C 2 ) over ¥ q whose decoding error probabili- 
ties, Px for CxlC 2 and P 2 for C 2 /Cx, are bounded by 

Pj < q - nE ( w i> r i)+°( n \ n £ N, j 



1,2. 



(5) 



Here, rj is the rate of Cj (when it is viewed as a classical 
code). Then, for any fixed number R Q , < R < 1, there 
exists a sequence of [[A^ ,if ]] code pairs (Lx,L 2 ) of the 
following properties, (i) The rate K /N approaches R Q . (ii) 
The decoding error probability P c j is bounded by 

limsup--^log P e j 



> 



- max min (T — Ra)E(W^, ri) 

2 (r 1 +r 2 -l)(Rx+R2-l)=Ro J6{1,2} V 



for j = 1,2, where the maximum is taken over 
{{rx,r 2 ,Rx,R 2 ) | < r 3 - < 1,0 < Rj < lforj = l,2, 
(rx +r 2 - l)(Rx + R 2 - 1) = R Q }. (iii) The codes L x /L^ 
and L 2 /Lx are decodable with algorithms of polynomial 
complexity. 

In the theorem, the sequence {(Lx,L 2 )} actually consists 
of [[iV 0)I/ , if 0>v ]] code pairs L 2 ^), v € N, such that 

N Q _ V — * 00 as v. 

To prove this theorem, we will present a general concatena- 
tion method for CSS codes. Then, proving (i) and (ii) will be a 
routine, following [5]. However, to establish (iii), a method for 
constructing parity check matrices that enables us to decode 
Lj/Lj, where 1 = 2 and 2 = 1, in polynomial time is needed. 
This will also be presented, and besides the concatenation 
method, this would be the most novel part of the present work. 

B. Review of Needed Results on Exponential Error Bounds 

To make Theorem Q] meaningful, we need good codes 
satisfying the premise of the theorem. These codes will be 
used as inner codes in concatenation. Therefore, we begin with 
reviewing results on the needed good inner codes [21]. 

We know the existence of a sequence of [[n, k}] code 
pairs (Ci,C 2 ) attaining the random coding error exponent 
E T (Wj, rj); For any rate pair (ri,r 2 ) and for any pair of 
additive channels (Wi, W 2 ), we have 

Pj < q - nE ^^)+o(n)^ n eN, j = 1,2 

where 



E x (Wj 



mi4D(Q||^; 



II 



H{Q)\~ 



(6) 



Here, H and D denote the Shannon entropy and the Kullback- 
Leibler information, respectively, the minimum is taken over 
all probability distributions on ¥ q , and \x\ + — max{0,a;}. 
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This was proved as follows [21, Section 10.3]. We know 
there exists a good classical code C\ satisfying (|5]l for j = 1 
with E = E r . Then, for an arbitrarily fixed n, we consider all 
possible codes C2 with Ci < C2 of a fixed size. Evaluating 
the average of decoding error probability of C2 / Ci over this 
ensemble, we obtain (0 also for j = 2. 

C. Achievable Rates of Efficiently Decodable CSS Codes 

We describe implications of Theorem Q] here. As reviewed 
above, the bound in (0 has been proved for the random coding 
exponent E = E T , Note in this case, E(rj,Wj) is positive 
whenever r 3 < C(Wj) = 1 - H(Wj), j = 1, 2, and that for 
any e, we can take n , , Ri , R2 such that C(Wj) > rj > 
C(Wj) - e and 1 > Rj > 1 - e for j = 1,2. Hence, for 
any 6 > 0, we can choose r\ , r 2 , R% , R2 such that R = 
(n + r 2 - l)(i?i + i? 2 - 1) > C(Wi) - C(W 2 ) - 1 - 8 
and mirijg/i ,2}(1 — ,rj) is positive. Thus, the rate 

C(Wi) + C(W2) — 1 is achievable. In the literature, e.g., in 
[14], the binary case {q = 2) with W\ = W% has sometimes 
been discussed without presenting efficiently decodable codes 
that achieve any positive rate. In this binary case, some call 
1 — 2H(W\) the Shannon rate, which equals the rate C(W\) + 
C(W 2 ) -1 = 1- H{Wx) - H(W 2 ) for W x = W 2 . This rate 
is the highest among those known to be achievable by CSS 
codes. 

The pair of efficient decoders for L^jL^ and L 2 /L^ 
(Theorem [U, which involve only with classical information 
processing, will be useful for quantum error correction pro- 
vided the recovery operation is done in a standard manner [6], 
[7], i.e., by measuring the syndromes and applying the inverse 
of the estimated quantum error pattern. The task of the above 
classical decoders is estimating the error pattern from the 
syndromes. 

We remark that Theorem Q] has direct implications on the 
reliability of the CSS quantum codes specified by (LijLz): 
The fidelity of the CSS code is lower-bounded by 1 — P e< \ — 
P c ,2 owing to 

IV. Concatenation of Codes of CSS Type 
A. Construction of Codes 

In this section, we will present a method for creating 
concatenated code pairs, (Li,L 2 ) with < L 2 . 

Lemma 1: Assume (C\ : C2) is an [[n, k}] code pair over 
F q , and 

Ci =C 2 L +span{ 5 i ) ,..., 5 ^ ) }. 
Then, we can find vectors g^,..., gj such that 



C 2 



C 2 = Ci + span {g\\ g k >} 



and 



1) 2) 



(7) 



where <5y is the Kronecker delta. 

Proof See Fig. ffl If C x = + span {g?, ...,g$}< F™ 
and H2 is a full-rank parity check matrix of C2, we have an 
invertible matrix, A, as depicted at the left-most position of 
Fig. Q] Of course, we have its inverse A -1 , which is depicted 




2)1 

9i ■ 



2)t 

■9k 



Ci 



HI 



Fig. 1. A basic structure of an [[n, k]] code pair. 



next to A in the figure. Write <^ , . . . , g 2 ^ for the (n— fe + l)- 
th to fci-th columns of A -1 . Then, we see that g*' ■ g 2 ) — Sij 
and the last n— k x columns of the second matrix are orthogonal 
to the [n, ki] code C\. □ 

Let (Ci, C2) be an [[n, k}] code pair over ¥ q , where C\ and 

C2 are an [n, k x ] code and an [n, A^l code, respectively, with 

1) 2) 

k = k\ + k2 — n. Assume g { and g- satisfy the conditions in 
Lemma Q] The field ¥ q k is an F g -linear vector space, and we 

can take bases ) ._ t and (/3| ) - =1 that are dual to each 
other with respect to the F g -bilinear form (Section rVIII or. e.g., 
[22], [23]) defined by 



ft 



¥ q k x ¥ qk 



Tr F ?fc /F g xy. 
2h fc 



(8) 



Namely, we have bases (^f3 J ; ) . —1 and (p. ) —1 that satisfy 

Relating (ft^f) with naturally, we have a map 

that sends vectors in F£» to the space 

iV 

0span{5 1 l) ,... ) fli^ ) } 

and that preserves the inner product. Namely, applying 

TTm : F gfc -> span{ 5 ™ } , ■ ■ ■ ,5^ } - C m /C±, 

to each coordinate of a vector 



(9) 



we have a vector in F^ (to = 1,2). This extension of 7r m is 



x = (xi, . 
again denoted by 7r„ 

7T m (a;) = (7T m (xi)| • • • |7T m (xjv))- 

Then, for any x = (x x , . . .,x N ) and y = (yi, . . .,yjv), 

Tl >,fc/F 9 x ■ v = 7r i( a; ) • ^2(2/). (io) 

This is because we have 

Tr F fc /F, = tti(^) • 7r 2 (yi) 



for each i£ [1,N]. 

Definition 1: The concatenation (or concatenated code pair 
made) of the generic [[n, k]] code pair (C\,C2) over ¥ q and 
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an [[N,K]} code pair (D 1 ,D 2 ) over ¥ qk is the [\nN,kK]} 
code pair 

(7n(£>i) + cf, Mr^ + C^) 

over F g , where 



Cfn — ^mi TO — 1, 2. 



The codes C\ , C2 are sometimes called inner codes, and 
Di,D 2 outer codes. 
Theorem 2: 

[K 1 {Di) + Gt\ x = * 2 {D 2 ) + Cj : , 

[K 2 {Di) + Ct] x = -K l {D l ) + Ci. 

Corollary 1: The concatenated code pair in Definition[T]can 
be written as 

{^{Dt) + CJ,-k 2 {D 2 ) +~Cj). 

Proof. It is enough to prove the second equality by virtue 
of the symmetry. First, we show 



[7r 2 ( J D 1 ± ) + C 1 ^] x >7r 1 (Z> 1 )+C 2 J -, 



(11) 



which is equivalent to 



n 1 (D 1 ) + C 2 L ±n 2 (Di) + Ct. 

The code wi(Di) is orthogonal to ir 2 (D^) by ( fTUl ), and to 
Ci trivially. Similarly, C 2 is orthogonal to ir 2 (Di). By the 
basic property (|2]), C 2 and are orthogonal to each other, 
and hence, C 2 is orthogonal to Cjk 

Thus, we have CO)- Since dim F j7r 2 (£>] L ) + Cf] + 
dirriF, [tti (D\ ) + C 2 ] = nN, we have the lemma, and hence, 
the corollary. □ 



B. Parity Check Matrices 

Note that a generator matrix of n 2 (D± ) + over ¥ q has 
the form 



Hi 

o 
o 

G'l.l 



o 

Hi 

o 

G\o 



O 
O 

Hi 



G> 



l.N 



G' 



M.l 



G' r 



Ma 



M,N. 



(12) 



where Hi is a parity check matrix of C\, O is the zero matrix, 
M = N—K\ (Ki is the dimension of Di), and for each (i, j), 
G'j ■. i is a k x n matrix whose rows are spanned by gf 1 . Hence, 
by Theorem 12 (fT2l is a parity check matrix of iri(Di) + C 2 . 

The next task is to devise a method to choose G'- „■ in such 
a way that efficient decoding is possible. We will present such 
a method below. 



In the method, the matrices G' , in ( TT2T > are obtained from 
a parity check matrix H = [hji] of Dx. Recall we have fixed 
two bases b = (/3j ) _j and b' = (/3? ) tnat are dual 
to each other in constructing concatenated codes. Take a root 
a of a primitive polynomial / over ¥ q . We set = T l 

for i = 0, . . . , q k — 2, where T is the companion matrix of 
/, which will be defined in Section [VTA and put $(0) = O. 
For simplicity, we set b = (1, a, . . . , (This basis will 



appear as a = (1, a, 



Js-l 



) in what follows.) 



Procedure for creating G'^ iy j € [1, M], i € [1, JV]. 
Step 1. We produce from /i^. 

Step 2. We replace each row 77 = (77!, . . . , of 
$(%) by 



E 



?7m5„ 



(13) 



and set the resulting k x n matrix equal to G'j 4 . 
Example 1. (a) Let (7 = 2 and fc = 3. The companion matrix 
of a primitive polynomial f(x) = x 3 + x + 1 is 



T = 



1 

1 1 
10 



Let a be a root of f(x), and H = [1 a] a parity check matrix 
of a code Di over F„jc . Then, we have 



H' = [$(1) $(a)] 



(b) The parity check matrix H Q of Li in ( fT2l for the 
concatenation (L\ 1 L 2 ) of an arbitrary (Ci,C2) and, say, 
(Di,F^ fc ) should be obtained from H' = [$(1) $(a)] by 
the additional process of Step 2 for our purpose. While there 
are many parity check matrices of L\ such as obtained by row 
permutations from this matrix H a , this particular choice of H Q 
gives the desired parity check matrix of L\, which is useful 
for efficient decoding. □ 

We will see how this method works in Sections [V] through 

Enn 

V. Decoding Strategy for Concatenated Codes of 
CSS Type 

We first sketch how to dec ode the concatenated code 
LxjL^, where L 1 = %i(Di) + and L 2 = [tti(D^) + 
C^}^ = tt 2 (D 2 ) + ~Cj. This is a half of the pair 
(Li/L 2 , L 2 /Li), and the other half, having the same form, 
can be treated similarly. 

We remark that in known applications of code pairs 
(61,62) with C 2 < Ci, i.e., for CSS quantum codes and 
cryptographic codes as in [10], [11], the decoding should 
be a syndrome decoding, which consists of measuring the 
syndrome, estimating the error pattern, and canceling the effect 
of the error. 

We decode the code in the following two stages. 
1) For each of the inner codes, C\jC 2 , we perform a 
syndrome decoding. 
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2) For the outer code D\, we perform an efficient decoding 
such as bounded distance decoding. 

For efficient decoding, the outer code D\ should allow a 
decoding algorithm of polynomial complexity in N. Then, if 
N > q Tk and k/n — ► r as n — * oo, where r > and r > are 
constants, the concatenated codes Lx/L^ can be decoded with 
polynomial complexity in N, and hence in the overall code- 
length nN, Generalized Reed-Solomon (GRS) codes [23] are 
examples of such codes. 

The decoding for the outer code should be done based on 
the latter half of the syndrome that comes from the lower half 
of the parity check matrix in dl2l . This is possible as will be 
argued in Section IVIII-BI For this argument, we need some 
lemma, which is given in Section [VI] 

VI. Dual Bases and Homomorphisms of Extension 
Field Into Space of Matrices 
If b = {f3j)j =1 is a basis of the F g -linear vector space ¥ q k, 
any element £ G ¥ q k can be written as 

£ = xifa H h Xftfik- 

The row vector . . . , x^) obtained in this way is denoted 
by <fb(0- The next lemma is fundamental to our arguments 
in what follows. 

Lemma 2: Let a denote the basis (aP~ for a primitive 
element a of ¥ q k, and a' the dual basis of a. There exists a 
one-to-one map <£> a : ¥ q k — > F^ xfc (the set of k x k matrices 
over W q ) with the following properties. For any G F g *, 

^(OVaKO* = PafcO*. M0*»(O = MM) (14) 

and 

*a(0*a(O =*a(«'), + *a(£0 = + £')■ (15) 

The lemma is proved in an elementary manner in Sec- 
tion IVHI The part of Lemma [2] only involved with cp a 
has sometimes been used in implementing codes. However, 
Lemma [2] in which dual bases ip a and tp a i are featured, was 
devised here for decoding of concatenated code pairs. 

VII. Proof of Lemma[2] 
We will first construct maps cp a and <£> a satisfying (fT4] i 
and (15[ except '</>a'(£)^a(£') = fa' (££')'' an( l move on to 
proving the remaining part of the lemma. 

A. Companion Matrix 

We use the following alternative visual notation for ipi, in 
the case where b = a: 

I 

£ = <Pa(Cf which has form 



6,-1 

Let f(x) = x k — fk-ix k ~ 1 — ■ ■ ■ — fix—fo be the minimum 
polynomial of a over ¥ q . The companion matrix of f{x) is 

fc -i f ' 
h 

Ik-l ; 

fk-1 



T 



(16) 



where Ofc_i is the zero vector in F^ 1 , and Ik-i is the (k — 
1) X (k — 1) identity matrix. Note that 



T 



a 



Then, we have 



Ta % = a l+1 , ie[0,q k -2], 



(17) 



(18) 



which can easily be checked. 

We list properties of T, all of which easily follow from ( fl~8b . 
By repeated use of ( fT8l . we have 



Tot? = a l+ J 



(19) 



for i,j G [0, q k — 2]. This implies 



a' 



„i+fe-l 



and hence, 
and 



J 11 _|_ Jtf = J 1 ' 



G[0,g fe -2] (20) 

(21) 
(22) 



with I satisfying a 1 + op = a 1 . 
To sum up, the map defined by 



$ a :a l ^T l , i€[0,q k -2], 

and $3(0) = Ofc (zero matrix) is a homomorphism by d2Tb and 
d22l . Namely, O holds. Moreover, by (Q2), for any £, £' G 



(23) 



B. Dual Bases 

In what follows, Tr F k / ¥q will be abbreviated as Tr. Put 

tp'iO = (Tr£,Tra£, . . . .Tr^'Q. (24) 
Then, it follows 

<p'm a (0 = f'm (25) 

for any £, £' G F g *. 
Proof of We have 

= W(0,...,0,/ o ) 

+ W +1 (l,0,...,0,/i) + "- 
+ Tra l+fe - 1 (0,...,0,l,/ fc _ 1 ) 

= C&a i+1 ,...,llra <+ *- 1 ,aj), 

x = Ti>7o + --- + a l+fc ~ 1 A-i) 

= W(/ + --- + a fe - 1 /fc-i) 
= Tra 4+fc . 



where 
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Hence, 

<p'(a i )T = l p'(a i+1 ), (26) 

which is the basic property that parallels (\M . Applying ( |26| i 
repeatedly, we obtain d25l l. □ 

It is well-known that any basis has a dual basis [22]. In 
particular, denoting by a' the dual basis of a, we have ip' = ip 3 i 
from (l24liFl Then, we can write (l25T l as 

MO$a(£') = ¥V (££'), ( 27 ) 

which makes good dual properties with d23l l. 

Thus, we have <TT~4T >. which consists of (l23l l and d27l i. Since 
we have already shown (fl3T l. the proof is complete. 



B. Syndromes of Concatenated Codes of CSS Type 

Now we finally see the procedure for constructing G'a i in 
(fT2l from a parity check matrix H of Di, which was presented 
in Section IIV-BI (Steps 1 and 2), is useful for decoding the 
concatenated code Lx/L^ as promised. 

In fact, with the parity check matrix in (fT2l and G'j i 
constructed by the procedure, the latter half of the syndrome 
is the same as cp(x)H n by @, where ip = ipt,. Namely, for 

g' = [g;,], 

■K X (x)G n = <p{x)H n . 

Hence, known procedures to estimate the error pattern from 
the syndrome for D\ can be used to decode iri(Di). 



VIII. Syndrome Decoding for Concatenated Codes 
of CSS Type 

Having found a useful pair of dual bases a and a', we set 
b = a and b' = a in this section. We put ip = ip 3 , ip' = ip 3 i 
and $ = $ a for simplicity. 



A. Decoding of q-ary Images of Codes 

We first recall how we can obtain a parity check matrix over 
¥ q of the 'g-ary image' of a code over an extension field ¥ q k. 
We need some notation. We extend the domain of <p [ip'] to 
F^f, where M is a positive integer, in the natural manner: We 
apply <p [ip'] to each symbol of a word x E F^f, and denote 
the resulting fcA/-dimensional vector over ¥ q by p(x) [ip'(x)]. 
In the present case, the g-ary image of an [N, K] linear code 
D over ¥ q k denotes the [kN, kK] linear code <p{D) or <p'(D) 
over ¥ q . 

Let H be a parity check matrix of D\. We will show that 
we can find a matrix H' such that 

<p(xH t )=<p(x)H n , xeF#. (28) 

Let us write H = [hji] with hji € ¥ q k. Then, (f28b holds for 
the matrix H' = [&(hji)} with $ = $ a as in Lemma|2] This is 
a direct consequence of the first equation of (fT4l > of Lemma 
which can be rewritten as y^O^KO* = 'P(£€')- ^ n particular, 
we have, for H' = [®(hji)], 

cp(Di) = {ye | yH n - 0}. (29) 

We remark that we do not have to find the dual basis a' = b' 
of a = b explicitly in constructing W . A parity check matrix 
of p 1 (D-i) can similarly be obtained. 

3 For the sake of self-containedness, we remark that the existence of a dual 
basis of a can be proved easily with the developments in this section as will be 
sketched. Using i\5\ and {25), we can show <p'(a l ) ranges over all non-zero 
vectors in as i runs through [0,q k — 2]. Hence, letting ji £ [0,q k — 2] 
denote the number such that (p'(a Ji ) = (0, . . . , 0, 1, 0, . . . , 0), where the 
i-th coordinate has the only non-vanishing component 1, we conclude that 
a' = (« Ji )*L 1 is the dual basis of a by )24t . 



IX. Proof of Theorem Q] 

We will establish the bound by evaluating the decoding error 
probabilities of the concatenation (L\,L<2) of (Ci,C2) and 
(Di, D2) as described in Section [IV] In the concatenation, we 
use the pair (Ci,C%) attaining the exponent E{Wj,rf) for 
inner codes, and generalized Reed-Solomon codes for outer 
codes Dj of dimensions Kj (j = 1,2). We consider an 
asymptotic situation where both N and n go to 00, Rj = 
Kj/N approaches a fixed rate R*, and rj approaches a rate 
r* (j — 1,2). The decoding error probability P e> j of Lj/Lj 
is bounded by 

N 
i=b 

< q b\og q P 3 +{N-b)\og q (l-P 3 )+Nh(b/N) 

where h is the binary entropy function, and b = [(N — 
Kj)/2\ + 1. Then, we have 

+ l^lo gq (l-P j ) + h(b/N) 
n N H n 

for j — 1,2. Hence, the decoding error probability P c j of the 
concatenated code Lj/Ljr satisfy 

lim sup - — log P c j > - min (1 - R*)E{r* ) . 

7V ^oo Ao 2 J6{1,2} J J 

for j = 1,2. Thus, we have the error bound in the theorem. 

The detailed procedures for decoding and constructions 
of parity check matrices for (general) concatenated codes 
(Li,L2) have been presented in Sections lIV-BI through IVIIIl 
Note that n is proportional to k w \og q N and therefore 
that even with exhaustive syndrome decoding, the decoding 
complexity for inner codes is at most polynomial in q n , 
which is still polynomial in q k w N or A D = nN. Hence, 
the constructed codes Lx/L^ and LijLy are polynomially 
decodable. This completes the proof. 
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X. Minimum Distance of Quantum Codes 

A. Polynomial Constructions of Quantum Codes 

We move on to treating the issue of polynomial-time 
constructions of encoders of quantum error-correcting codes. 
In what follows, the measure of goodness is the minimum 
distance of codes. 

As already mentioned, this issue was first treated in [4]. 
One important ingredient of the code construction in [4] is 
a sequence of polynomially constructible algebraic geometry 
(AG) codes. These codes attain the Tsfasman-VladuJ-Zink 
(TVZ) bound, and are built on a deep theory of modular 
curves [16]. Alternative polynomially constructible geometric 
Goppa codes (AG codes) that attain the TVZ bound were 
recently found [24]. We use these codes [24] in our con- 
structions of codes in what follows. (Those familiar with the 
original polynomially constructible codes attaining the TVZ 
bound [16] can use them instead.) The code construction in 
[24] relies on the theory of (algebraic) function fields [25], so 
that we will also use the terminology in [25]. 

B. Metrics for Quotient Spaces 

To evaluate minimum distance, we use the metric naturally 
induced in a quotient space [21]. We begin with reviewing 
this metric. Suppose we have spaces of the form V = Z/B, 
where B < Z are finite additive groups. Given a non-negative 
function W on Z, a function D on Z x Z defined by D(x, y) = 
\N(y—x) is a metric if W satisfies (i) triangle inequality W(x+ 
y) < W(a;) + W(y), x, y G Z, (ii) \N(x) = if and only if 
x is zero, and (iii) \N(x) — \N(—x). We have the following 
lemma [21, Appendix, A. 3]. 

Lemma 3: Given a function W on Z, define Wb(5) = 
miorg % W (x) for x G Z/B. Then, whichever of properties 
(i), (ii) and (iii) W has, inherits the same properties from 
W. 

The easy proof omitted in [21] is included below. 

Proof of Lemma \3\ Given x,y £ Z /B, let x and y attain 
the minimum of min^gj \N(x) and that of mm ye y W(y), 
respectively. Then, 

Wb^+Wjj® = W(.T)+W(y) 

> \N(x + y) 

> min^W(z) 

zex+y 

= w B (^Ty) 

where x + y = x + y G Z/B. This prove the statement on 
(i). That on (ii) is trivial. To see that on (iii), it is enough to 
notice that when z runs through x = x + B, —z runs through 

-x-B = -x + B = -x. □ 

The lemma is, of course, applicable to the Hamming weight, 
denoted by w, on the direct sum F™ of n copies of an additive 
group F. Namely, the quotient space ¥ n /B is endowed with 
the weight w#, defined by wb(x) = min^gj w(a:) for x G 
¥ n /B, and the distance 6b(x, y) = wsiy — x). The minimum 
distance of a quotient code C/B is denoted by ds(C) and 



defined as follows: 

d B (C) = min{d s (x,y) \x,ye C/B, x^y} 
= min{w B (x) | x G C/B, x ^ B} 
= w(C\B) (30) 

where, for A C F", 

w(A) = min{w(a;) | x G A}. 

The minimum distance of the symplectic code generated 
by a matrix Q = [G X G Z ], regarded as the quotient code 
span /spa n7i, is 

min{w([u, v]) \ (u\v) 6 span Q \ span H} 

where spanTi is the f s -dual of spanC* as given in Section ITT1 
[u,v] denotes ((iti, Ui), ■ • • , (wjv o) V N )) G X N °, X — F^, 
for u = (ui, . .. ,UN a ) and v = (vx, . . . , vn ) G F^°, and 
w([u, v]) is the number of i with (tt<,u<) (0, 0). In particular, 
if H is as in ([T]i with span Hj = Cj~ (J = 1, 2), the minimum 
distance of the CSS code S css (Ci,C2) is given by 

min{d 02 x(Cx),d c x(C 2 )}. 

The minimum distance of the code pair (Ci,C2) is also 
defined to be min{d c _L (Ci), d c _L (C2)}. An [[n, k]] symplectic 
code of minimum distance d is called an [[n, k, d]] symplectic 
code. Similarly, an [[n, k, d}] CSS code (code pair) is an [[n, k]] 
CSS code (code pair) of minimum distance d. An [[n, k, > d}] 
symplectic code refers to an [[n, k, d']] symplectic code with 
dl > d. 

XI. Minimum Distance of Concatenated Codes 

We will evaluate the minimum distances of Lx/L^ and 
L 2 /Li foiLx =tti (Dx)+ ~Cj and L 2 = [ttx(D^) +~Cj} ± = 
^2(^2) + Ci for the concatenated code pair as in Section [TV] 
For most part, we describe the argument only for Lx/L^, the 
other case being obvious by symmetry. 

Here, an underlying idea that has brought about the results 
of the present work is expl ained. The point is that both L\ and 
L2 have the subspace C%, and we encode no information into 
C% ■ Namely, we encode a message into a 'code-coset' of the 
form u + L2 G Li/L^, which can be written in the form 
[J v (v + C2 ) since we have C 2 < L% (< L\). This means 
there is no harm in dealing with the quotient space F^°/C^-, 
where N Q = nN, in place of F^°, which is to be dealt with 
when the conventional concatenated codes are in question. 
This is possible because the space F^/C^ is endowed with 
the weight w c _l as described in Section IX-BI 

Lemma 4: The mini mum distance o f th e quotient code 

L1/L2 = [kx(Dx) +C 2 T ]/l^( D 2 ) + Ct\ is d i d '' wher e 
d\ = A c ± (Ci) and d! = d c j_ (Dx). The minimum distance of 

the quotient code L 2 /Li = [n 2 {D 2 ) +~Cj]/[MDi) + ~Cj] 
is d 2 d", where d 2 — d c ±(C 2 ) and d" — d D ±(D 2 ). 

Corollary 2: The minimum distance of S css (Li,L 2 ) is 
minjc?!^, d 2 d"}. 

Proof. By symmetry, it is enough to show the first statement 
of the lemma. We see this easily working with d-^x. In fact, 
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for any x G Di \ D^, the Hamming weight of x e is not 
smaller than d! , and the i-th symbol xi e ¥ q k of x is mapped 
to (a representative of) ffi G Ci/G 2 for any 1 < i < iV by 
7Ti. Since 7^ G^ has Hamming weight not less than di, the 
minimum weight of Li/L 2 is lower-bounded by did 1 . The 
minimum weight is, in fact, did' since we can choose a word 
x E Di\ D2 of weight <f and a coset yl € C\ / C2 1 of weight 
rfi. Hence, we have the assertion in the lemma. The corollary 
is trivial. □ 

XII. Bound on Minimum Distance 
A. The Bound 

In this section, we will present codes that exceed those in 
[4], [18] in minimum distance for a wide region. Specifically, 
we will prove the following theorem. 

Theorem 3: Let a number < R < 1 be given. There exists 
a sequence of polynomially constructible [[N a K „, d ov ]\ 
code pairs that satisfies 

liminf > sup dld2 (l - 2 7/c - ~R) , 

lim^oo K 0tU /N 0tU = R, and lim^oo N ^ = 00. Here, 
7fc = (q k ^ 2 — l) -1 , and the supremum is taken over all 
(n,k,di,d2) such that an [[n, k]] code pair (GijGa) exists, 
di = w(Ci \ C2), d 2 — w(C2 \ Ci), and q fc is a square (of 
a power of a prime). 

Remark. The polynomial constructibility of the sequence of 
code pairs, {(Li yl/ , £2,1/)}, is to be understood as the existence 
of a polynomial algorithm to produce a generator matrix G v 
of Li ;1/ whose first N 0tV — K 2<v rows span Ljf v for each z/ (cf. 
Fig- [0- Note such a generator matrix of L\ v can be converted 
into the generator matrix of L 2>v whose first N OM — K\ tV 
rows span „ polynomially. (The conversion can be done 
by calculating the inverse of an N 0t „ x N ojy matrix involving 
G v . To see this, put Cj — Lj tV in Fig. Q] j = 1,2.) □ 

The above definition of constructibility is suitable both for 
applications to wiretap channels and for those to quantum 
error correction. The former applications would be detailed 
elsewhere. Regarding quantum error correction, note we can 
readily obtain parity check matrices, Hi and H2, of L\ M 
and L2 : v from G v as above. Note also that the so-called 
stabilizer of the corresponding quantum code is equivalent 
to the matrix H associated with {Hi^H^} as in (Q3, and a 
polynomial-time encoder of the quantum code is obtained from 
this stabilizer efficiently for q even [26]. (Here, the complexity 
is measured in terms of elementary quantum gates, similarly 
to [4], for two-level quantum systems.) In fact, this directly 
follows from [26] for q = 2. To see it for q = 2™, note 
2 m -ary CSS codes can be converted into binary symplectic 
codes by expanding elements of ¥2™ using dual bases. This is 
another application of (the extreme case of) the concatenation 
method. (More generally, by [27], 2 m -ary symplectic codes 
can be converted into binary symplectic codes.) Because for p 
odd, no established complexity measure for circuits consisting 
of p-level quantum systems is known to the author, we will 
assume that q is even when discussing polynomial complexity 
of quantum codes over a Hilbert space in what follows. (In 



the binary case, standard elementary gates can be found, e.g., 
in [28, p. 73].) 

B. Proof of Theorem \3\ 

First, we describe geometric Goppa codes which are used 
as outer codes. We use codes over ¥ q k, where q k = p m with 
some p prime and m even, obtained from function fields of 
many rational places (places of degree one) as outer codes. 
Specifically, we use a sequence of function fields F v /¥ q k, 
v = 1,2,..., having genera g v and at least N v + 1 rational 
places such that [29] 

,. 9v def 1 

lim aT = 7fc = ~Th — T- (31) 

v— >oo iv„ q K l z — 1 

(The resulting codes of length N v are said to attain the 

TVZ bound.) We put A„ = P x H h P N „, where P l are 

distinct rational places in F u /¥ q k. Let G2.V be a divisor of 
F v j¥ q k having the form G2.1/ = m 2 < N v , where 

Poo is a rational place other than Pi, ... , Pm v ■ Then, we 
have an [N V ,K2, V \ code of minimum distance d" , where 
K 2 , v > degG 2 ,„ + 1 - g v and d" > N v - degG 2 , v - We 
use this code as outer code D2, and let have a similar 
form. Specifically, we put 

D2 = C c {A u ,G2,u) 

and 

Di = C c {.A v ,Gx lV ) ± , 

where Gi M = miPoo for some integer mi, and 

C c (A v ,G) = {(f(Pi),...,f(P N „)) |/e£(G)}. (32) 

Here, C(G) = {x E F v \ (x) > —G} U {0}, and (x) denotes 
the (principal) divisor of x (e.g., as in [25, p. 16]). We require 

Gi fV < G2.V 

so that the CSS constraint < D 2 is fulfilled. 
We also require 

2. 9 , - 2 < degG^ < N v , j - 1, 2. (33) 

Then, the dimension of D2 is 

K 2<v =<3imG2, v = degG 2 ,v- g v + l (34) 

and that of Di is 

Ki, v =N V - dimGi^ = N v - degG hv +g v -l. (35) 

The designed distance of D2 is N v — degG2^, and that of 
Di is degGi^ - 2g u + 2. 

With an inner [[n, k]] code pair (Gi, G2) fixed, we consider 
an asymptotic situation where Kj jU /N v approaches a fixed 
rate Rj as v goes to infinity (j = 1,2). Note that the limit 
of [K 2 , v ~ [N v - K llV )]/N v = (K llU + K 2 , v - N„)/N u , the 
information rate of the outer quotient codes, is given by 

R (l = R 1 +R 2 -l. (36) 

Then, the overall rate of the concatenated code pair (Li, L 2 ) 
has the limit 

Ro = * lim ^ + ^-^ = L - R(i . (37) 
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If the quotient code Cj/C^r, where 1 = 2 and 2=1, 
has minimum distance not smaller than dj, we can bound the 
minimum distance d a (j) of Lj/Li using Lemma |4] as follows: 



lim inf 



do (2) 
N , v 



> * 

n 


lim 

v — >oo 


N v - 


- cleg 








N v 






da 
n 


lim 

v — >oo 




Qv 
N v 


N v ) 




da 
n 


lim 

v — >oo 


(1- 


9v 
N v 


-Ra) 


(38) 



by (ED, and 



,. . t do(l) . di degGi,„ - 2g v 
lim ml > — lim 



n >oo N, 

n u—>oo \ N v 
by (1351 . Note the asymptotic form of d33l l is 

7 fc < Jij- < 1 - 7 fc , j = 1,2. 



lim (l - /? i ) (39) 



(40) 



lim inf 



It is expected that the best asymptotic bound will be 
obtained by requiring did 1 « d 2 d" ', where d' and d" are the 
minimum distances of the outer codes as in Lemma [4] Thus, 
we equalize the bound in ( |38l with that in ( |39] l, so that we 
have 

d 1 {l- lk ~R l )=d 2 (l- lk -R 2 ). 
Using this, d36l > and d37l >. we can rewrite (l38l and (l39l as 

di da / n \ 

for j = 1,2. 

In the above construction, the second Garcia-Stichtenoth 
(GS) tower of function fields was used as F v /F q h [29] bee 
[24] (also [30]) for a polynomial algorithm to produce parity 
check matrices of codes arising from the tower. This, together 
with the method in Section IIV-BI gives needed parity check 
matrices of L\ and L 2 . This completes the proof. 

C. Calculable Bounds 

First, we remark that Theorem [3] recovers the bound of [18] 
by restricting the inner codes in the following manner. Assume 
Ci is an [n = 2t + 1, k\ = 2t, d\ = 2] code such that Cj 1 = 
span&i with a fixed word b\ G (F g \ {0})", and C 2 is the 
[n, k 2 = 2t + 1, d 2 = 1] code, i.e., F". Then, the substitution 
of the inner code parameters into d4TT > gives the following 
bound [18]: 

2 (. 2 2t + 1 



^ CLX (i?o) = 



1 - 



-R 



(42) 



3(2t+l)V qt-l 2t 

When q is a square, Theorem |3] also implies the following 
bound, which equals the bound in [31, Theorem 3.6]. Namely, 

if we put n = ki=k 2 =d=l and C\ = C 2 — F™, we have 

2 



lim inf >l FLX 

y->oo N op 



(R) = l(i 



- R 



(43) 



4 This tower is explicitly given by F v = ¥ q k (xi, . . . , x v ~) with x l v +x v = 
x l v _J(;x l -\ + 1), is = 1,2,..., where I = q k / 2 , and Fx = ¥ qk (xx) with 
xx transcendental over ¥ q k . 



In particular, it was observed [31] that the bound in (|43l 
exceeds the Gilbert- Varshamov-type quantum bound in some 
range for q > 19 2 (as the Tsfasman-VladuJ-Zink bound is 
larger than the classical Gilbert- Varshamov bound for q > 49). 
In [31], this bound was proved to be attained by quantum 
codes described in a framework beyond symplectic codes; it 
seems difficult to construct encoders of polynomial complexity 
for their codes. By Theorem [5J we have established that this 
bound is attainable by polynomially constructible codes. 

Thus, the bound in Theorem[3]is not worse than the bounds 
in d42b and d43l ). We proceed to specifying an illustrative inner 
code pair, which results in a significant improvement. 

Take two (not necessarily distinct) words bi,b 2 € (¥ q \ 
{0})™ and set Cj- = span&j, j = 1,2. We require the 
condition (|2j, i.e., b\ ■ b 2 = 0, and use the [[n, n — 2,2]] 
code pair (Ci,C 2 ) as inner codes (di — d 2 — 2). With this 
choice of the inner code pair, Theorem [3] immediately yields 
the following proposition, where we put t = k/2 = (n— 2) /2. 

Proposition 1: Let a number < R < 1 be given. 
There exists a sequence of polynomially constructible 
[[N 0>v , K 0ill ,d 0>v \] code pairs that satisfies 

- 1 1 i+1 -4 



lim inf > sup ■ 



t+l\2 qt-l 



2t 



lim^^oo K OM /N OM = R, and lim^oo N OM = oo. Here, the 
supremum is taken over t such that q* > 3 is a power of a 
prime. 

XIII. Comparisons 

In this section, we will compare the bound in Propo- 
sition Q] with the best bounds known in the binary case 
(q = 2). Let a point (5, R) be called attainable if we 
have a sequence of polynomially constructible [[N v , K„, d„}] 
CSS codes S css (Ci >u , C%,J) such that liminfy d v /N v > S, 
lim inf ^ K^/Np > R, and lim^ N v = oo. Then, by Proposi- 
tion [T] the points in [_} t>3 M-t is attainable, where 

M t = {(5,R) |0<ci<land0<i?< R t {6)} (44) 



and 



Rt(S) 



t 



1 - 



2tS. 



t + l\ qt-l 
Note R = Rt(S) is merely a rewriting of 

1 /l 1 t+l 



(45) 



S = l t (R) = f 



R 



t+l\2 qt-l 2t 

Hence, our bound is the upper boundary of the region 
Ut>3^t: which is the envelope formed by the collection of 
the straight lines R = Rt(S), t > 3. This bound, together with 
previously known polynomial bounds, is plotted in Fig. [2] The 
improvement is clear from the figure. 

XIV. Steane's Enlargement of CSS Codes 

A. Effect of General Inner Codes and Another Effect 

Our concatenation method is applicable to any inner CSS 
codes. It is this flexibility that has brought about the improve- 
ment as presented in Fig. [2] From the figure, however, one sees 
the bound in [4] retains the superiority in some region, which 
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enlarged CSS codes 
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binary quantum codes 
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CSS codes 
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CSS codes 


N (d)GV bound 
v ^ for CSS codes 
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0.04 0.06 0.08 

relative minimum distance 5 



Fig. 2. Bounds on the minimum distance of binary CSS and enlarged CSS 
codes. The plotted bounds are (a) bound attainable by enlarged CSS codes 
in [4], (b) the bound attainable by the CSS codes in [18], (c) the improved 
bound on the minimum distance of CSS codes in Proposition[T] (d) the Gilbert- 
Varshamov-type bound R = 1 — IH2 (8) for CSS codes [6], where H2 {x) = 
— xlog 2 x — (1 — 3;)log 2 (l — x), and the Gilbert- Varshamov-type bound 
R = 1 — H2{&) — <51og 2 3 for binary quantum codes [1]. These codes are 
polynomially constructible except (d) and (e). 



must come from a distinct nature of the code construction of 
[4], namely, the property of enlarged CSS codes [8]. In this 
section, we present another construction of codes which has 
both the merits of the flexibility of inner codes and the good 
distance property of enlarged CSS codes. 

B. Enlarged CSS Codes 

Enlarged CSS codes are a class of quantum error-correcting 
codes proposed by Steane [8]. These can be viewed as 
enlargements of CSS codes S CS s(£i, L\) and are defined as 
follows. The definition below is general in that it applies to 
any prime power q. 

Assume we have an [N a , K ) linear code L which contains 
its dual, L 1 - < L, and which can be enlarged to an [N Q , K' ) 
linear code L'. Let a generator matrix W of L' has the form 



W = 



U 
V 



(46) 



of L, and let M be a {K' - 


K ) 


x(K- 


Then, the code generated by 






' U 





Q = 





u 




V 


MV 



where U and V are of full rank, and U is a generator matrix 

■K ) invertible matrix. 



(47) 



is a symplectic code [8]. We denote this code by S cn i(W, M). 

Now suppose that xM ^ Ax for any A <G ¥ q , i.e., that M is 
fixed-point-free when it acts on the projective space (¥^° K ° \ 
{0})/ ~, where denotes the zero vector and x ~ y if and 
only if y = Xx for some A € ¥ q . This is possible by Lemmas [7] 
and [8] in Appendix U if the size K' D — K a of M is not less 
than 2. Such a choice of M results in a good symplectic code 
as the next lemma and corollaries show. These are essentially 
from [8] and [32]. 



Lemma 5: Assume we have an [N Q , K Q ] linear code L 
which contains its dual, L < L, and which can be enlarged 
to an [JV , K' ] linear code L', where K' Q > K a +2. Take a full- 
rank generator matrix W of L' having the form in (l46l l. where 
U is a generator matrix of L, and a fixed-point-free matrix M. 
Then, S eni (W, M) is an [[N , K +K' -N ,> min{d, d"}}} 
symplectic code, where d — w(L \ L :± ) and 

d" = min{w([u, v}) \u,veL'\ L ,A -, VA eF,,» / Xu}. 



Corollary 3: Under the assumptions of the lemma, 

S en i(W, M) is an [[JV OJ K Q + K' Q - N Q , > min{d, d' 2 }}} sym- 
plectic code, where 

4 = min{w([w, v]) \u,ve L'\ {0}, VA eF„t / Am}. 



Corollary 4: Under the assumptions of the lemma, 
S enl (W, M) is an [[JV OJ K + K' Q - N , > mm{d, \a±±dT\ }]] 
symplectic code, where d 1 = w(L' \ L ). 

Remarks. The premise of the lemma implies 



L' 1 - < L J 



< L< L'. 



(48) 



In Steane's original bound [8, Theorem 1], w(L \ {0}) and 
w(L' \ {0}) were used in place of d = w(L \ L ) and d 1 = 
w(L' \ L'^), respectively. 

The quantity d' 2 is the second generalized Hamming weight 
of L'. Corollary [3] with q = 2 was given in [32] to improve 
significantly on the bound in [8]. □ 

To prove Lemma [5] and corollaries, we should only examine 
the proof of Theorem 1 in [8] or the proof of its refinement, 
Theorem 2 of [32], noting that we may assume H', the 
generator matrix of L , is a submatrix of U (G in [8]). In 
particular, if q = 2, this can be done without pain. A proof 
for the general prime power q is included in Appendix U 

C. Enlargement of Concatenated Codes of the CSS Type 

In [4], Steane's construction was applied to binary images 
of geometric Goppa codes < D < D' . The binary image 
of a code D\ over F ' q k denotes iri(Di) with n = k, q = 2 
in the notation of Section [IV] We can regard the codes in 
[4] the enlargement of (tti(-Di), ^2(1)2)) with 7Ti = Tr 2 and 
D\ = D2, i.e., (7ri(£>i), ni(Di)), where the inner code pair 
(Ci,d) = (F£,F£) is the trivial [[n,n]] code. 

In what follows, we establish a similar bound attained 
by some enlargement of (71-1 (Di), 7Ti(Di)) with a geometric 
Goppa code D\ in the case where an [[n, k]] inner code pair 
(Ci, Ci) is not necessarily (¥ q k,¥ q k). In our construction, we 
also need the concatenation method of Section IIV1 so that we 
retain the notation therein. We require the existence of C\ 
satisfying the following conditions in order to make Tti and 
7T2 equal to each other. 

Conditions. 

(A) Ci <d< F«. 

(B) We have vectors g 1 ) , j = [1, k], which satisfy -gj — 
5ij and which, together with a basis of form a basis 
of Ci, where k — 2 dirriF G\ — n. 
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(C) ¥ qk has a self-dual basis (jfl^) ._ r 
Note (A), together with k = 2 dimp Ci — n, implies that 
(Ci,Ci) is an [In, fell code pair, cf. (0 and ||3}. Recall we 

3 1)«2)_ 1) 



have required Tr 



/to 



9i' -9j' = Sij in constructing 



the map 7r m : h-> , j € [l,fc], m= 1,2 (Section [TV]). 
Hence, under the conditions (A), (B) and (C), we have nx = 7T2 
as desired by setting 

Similarly to [4], we use a tower of codes D < D < D' 
over ¥ q k, all of which arise from some sequence of function 
fields Fi , i<2 , • • • , such as given in [29] and have the form 
a ■ Cc(A u ,G), where 



C C (A V , G) = { (f(P 1 ), f(P N )) | / e £(G)} 



and 



a - D = {(a-LXi, . .. , a N x N ) \ (xx, ... , x N ) S P} 

for some a — (ai, . . . , ajv ) G (F, \ {0})^. Specifically, 

D = a-C £ (A,,G), D' = a - Cc(A v , G'), 

where A v = Pi + ■ ■ ■ + P/v, Pi are distinct rational places 
in F v /V q k, and G, G' are divisors of F„/¥ q k whose supports 
are disjoint with that of A v . Put \xnx v g v jN = 7. A major 
difficulty of the construction resides in the constraint D < 
D < D', i.e., G^ < G < G' when D 1 is written as a ■ 
C C (A U ,G^). 

Under this condition, we apply Lemma [5] putting L = 
7Tx(D) + c[ and V = nx(D') + Cf, where tti and cf 
are as in Section [IV] 

Since Cx = C 2 , Theorem [2] implies L 1 - = tt x (D^) + Cf 
and L = ttx(D'^) + C-f . Namely, in the present case, the 
tower in (|48j can be written as 

7r 1 (D' ± ) + B < nx(D ± )+B < m(D) +B < tti(D') + B 

(49) 

where P = Cf = C*] 1 . Keeping in mind evaluating d^, 

rather than d, is enough for our purpose, one can calculate the 
bound in a manner similar to that in [4], which leads to the 
next proposition. A proof may be found in Appendix U 

Proposition 2: Assume we have an [[n, k, d}] code pair 
(Cx, Cx) over ¥ q for which the conditions (A), (B) and (C) are 
true, a sequence of function fields {F v /¥ q k}, and a sequence 
of positive integers {N u } with N v — > 00 (v — > 00) satisfying 
the following three conditions for any R' > R > 1/2. (i) 
For all large enough v, we have N — N v distinct rational 
places Pi,-- - , Pjv m Fu/¥ q k, and divisors G = G v and 
G' = G' v of F v j¥ q k such that (a) the supports of G,G' 
contain none of P t , ■ ■ ■ , P N , (b) G < G', and (c) D 1 - < D for 
D = a-C £ (A,G) with some a = (ai,...,ajv) € (F^jO})^ 
where ^4 = Pi + - • -+Pat. (ii) The genus g v of F v /¥ q k satisfies 

, dcf ,. g v 1 

7 = lim — < — . 



(iii) G and G' fulfill 



lim 



deg G - g v 
N 



N 



> R, lim 



deg G' - g v 
N 



> R'. 



Then, we have a sequence of [[N , K", d ]] symplectic codes 
Seni(W v , My) that satisfies lim^ iV = 00, 

K" 

liminf-f >P 



and 



i imin f4>^+y ri-27-^Po 



^^00 AT Q - (2g + l)n 
for any rate 



Po > 



k 



2(q + l)n 



(l-2 7 ). 



Remark. The assumption that for any P' > P > 1/2, (iii) 
holds says degG and degG' are flexible enough (P > 1/2 
stems from D < D). This, as well as the other two, is 
fulfilled for some 

i<ik/(i-ik) = {i k - 1 -iy\ (50) 

where 7^ = (q k / 2 — 1) _1 , and for polynomially constructible 
codes D and D', < D < D', if g*/ 2 is even [4]. Namely, 
in [4], they showed how such D and D' with ( f5Qb can be 
obtained from general geometric Goppa codes attaining the 
TVZ bound. If the codes from [33], [34], [35] are used instead, 
the premise of the proposition is true for 7 = 7fe. However, we 
should emphasize that using the suboptimal value 7 = — 
1) _1 in [4] is to establish the polynomial constructibility of 
the codes. We remark that their argument to obtain codes with 
7 = (-y^ 1 — 1) _1 (see Theorem 4 of [4]), is applicable to 
general geometric Goppa codes including the one that has been 
used in this paper, i.e., the code in [24] lf| As remarked in [4], 
the necessity to construct codes with D < D has never arisen 
before [4]. □ 

This proposition recovers the bound in [4] by putting 7 = 
(7^ — 1) _1 , q = 2, n = k = 2m and d = 1. As in 
Section IXHI we take inner code pairs with minimum distance 
two as an example. 

Lemma 6: For any square q of a power of two, and n > 3, 
we have an [n, n — 1] linear code Cx over ¥ q of the following 
properties. (A') Gj 1 = span b for some vector b € (¥ q \ {0}) n 
with b-b — 0. (B') We have vectors g l - , j G [1, n — 2], which 
satisfy gy ■ g^ — Sij and which, together with b, form a basis 
ofCi. 

A constructive proof of Lemma [6] is included in Ap- 
pendix lLDl For Cx in the lemma, (Cx, Cx) is an [[n, n— 2, 2]] 
code pair. Recall the well-known fact that ¥ q k has a self-dual 
basis over ¥ q if q is even [36] (also [22, p. 75] for the statement 
only). Thus, for a square of a power of two q = 2 2m > 2 and 
n = 3, 4, . . . , we have C\ that satisfy the conditions (A), (B) 
and (C). 

5 The status of results along the lines of [33], [34], [35] is as follows. Though 
the codes in [33], [34], [35] have the desirable properties D^- < D and 
7 = 7fe > t ne y have not been proved to be polynomially constructible. It is true 
that the descriptions of these codes in the form Cc {A, G) are explicit, i.e., the 
underlying sequence of function fields and A, G have been specified explicitly. 
However, we need to solve an additional problem of finding generator matrices 
of D = a ■ Cc(A, G) and D' = a ■ Cc(A, G') to establish the polynomial 
constructibility of D and D' . The problem of constructing optimal codes D, 
which arise from explicit function fields [29], in polynomial time without the 
constraint D < D had attracted interest until it was solved in [24]. 
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(a) Proposition 2, enlarged CSS codes, 
[[k,k,lj] inner code 



(c) GV bound for 
4-ary quanlum codes 
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Fig. 3. Bounds on the minimum distance of quaternary quantum codes 
(q = 4). The plotted bounds are (a) the bound on the minimum distance 
in Proposition [2] with n = k and d = 1, (b) the bound in Proposition [2] 
with k = n — 2 and d = 2, and (c) the Gilbert- Varshamov-type bound 
R = 1 — H(x)— 5 log 4 15 for quaternary quantum codes [27], where H(x) = 
— x\og 4 (x) — (1 — x) log 4 (l — x). These codes are polynomially constructible 
except (c). 



For these parameters q,n,k = n— 2, d = 2 and 7 = j(k) = f 
(j7 — l) -1 , the bound in Proposition [2] becomes 

^^WTY) [1 - 2m] ^^ (51) 



where 



Ro > 



k 



10(fc + 2 



■[1- 27(A)], 



(52) 



and this is attainable by polynomially constructible 
[[N , K", d ]} symplectic codes. 

D. Comparisons 

The constructive bound in ( f5Tb , as well as the similar 
bound with the [[k,k, 1]] inner code, is plotted in Fig. [3] for 
q = 4. These bounds use constructible geometric Goppa codes 
with 7 < (777 1 — 1) _1 - One sees that the enlargement of 
concatenated CSS codes with the [[k + 2, k, 2]] inner code pair 
outperforms the enlargement with the [[k, k, 1]] inner code pair 
for relatively large <5. Namely, the flexibility of inner code 
pairs is effective also for constructions of enlargements of 
concatenated CSS codes@ 

For any prime power q, observe that the bound in Proposi- 
tion [2] with n = k = d = 1 and 7 = 7^ exceeds the bound 
in d43l ). Thus, finding constructible dual-containing codes with 
7 = 7 fe would be an interesting future topic (cf. footnote 5). 

XV. Summary and Remarks 

A method for concatenating quantum codes was presented. 
We also showed how to construct parity check matrices of 
concatenated quantum codes preserving the syndromes for 

s The author did not find any instance of the bound )4U . which uses CSS 
construction, that exceed the bounds (a) and (b) in Fig.f5]except Proposition [T] 
with t = 2. This exceeds (a) and (b) slightly only in the narrow interval 
1/7 0.1429 < S < 0.1444, where the bounds (a) and (b) vanish. 



outer codes before concatenation. Based on these results, it 
was proved that the so-called Shannon rate is achievable by 
efficiently decodable codes. The minimum distance of con- 
catenated quantum codes was also evaluated to demonstrate 
that the proposed code class contains codes superior to those 
previously known. 

We remark that for the codes L/B obtained by means of 
concatenation in this work, the minimum distance Ab{L) = 
w(L\ B) of L/B is significantly larger than the usual mini- 
mum distance w(L \ {0}) of L. In fact, B contains the space 
of the form C^, which implies w{L\{0})/N o < 1/N, 

where N a and N are the length of L and that of the outer 
code, respectively. It was demonstrated that the underlying 
metric structure, d^, plays a role in evaluating w(L\ B). 

After completing the revision for the second submission, 
the author learned that attainable asymptotic relative minimum 
distance of concatenated quantum codes, where the outer codes 
are CSS-type AG codes, are also discussed in [37]. However, 
the AG codes used in [37] are the non-constructible dual- 
containing codes specified in [34], and hence, the resulting 
codes are not constructible (cf. footnote 5). In [37], symplectic 
codes from the table of [2] are used as inner codes. The 
best lower bound in [37, Figure 2], as ours, depends on the 
parameters, [[n, k, d]], of the inner code. Unfortunately, these 
inner codes are not specified explicitly in [37]. However, the 
plotted lines in [37, Figure 2] suggest that there seems to be 
only one choice of [[n, k, d]] that gives a line (lower bound) 
exceeding those given in the present work. Namely, in [37, 
Figure 2], one can find a lower bound, which is higher than 
ours in the interval 0.071 < S < 0.10, and which seems based 
on a non-CSS-type inner code. The present author checked 
that this bound can be attained by polynomially constructible 
codes replacing the non-constructible outer codes in [37] with 
the constructible codes used in the present work. 

The issue of finding a polynomial construction of a tower 
of codes D < D < D' with the optimal parameter 7 = 7^, 
which was addressed in footnote 5 (Remark to Proposition |2), 
would be interesting. This is because the enlarged CSS codes 
in Proposition [2] with j — jk outperform the corresponding 
CSS codes, and hence, improve on many of the best construc- 
tive bounds presented or mentioned in this work. This issue 
would be treated elsewhere. 

The editor drew the author's attention to [38, Section 7.3], 
where concatenation of a general quantum codes and a 'ran- 
dom graph code' was used in a Shannon-theoretic argument. 
However, complexity issues were discarded in [38]. 

The title of the paper, largely suggested by the editor, 
would be more suitable if the polynomial-time construction of 
efficiently decodable concatenated codes in [39, Section VI] 
(where the restriction k^ — k% on me inner codes can be 
dropped) had been included. The codes achieve the same rate 
1 - H(Wi) - H(W 2 ) as the codes in Theorem [T1 (Section ITDl. 

Appendix I 
Proofs for Enlarged CSS Codes 

A. Fixed-Point-Free Matrix 

In this subsection, we show the existence of a needed fixed- 
point-free matrix. In fact, it is a companion matrix defined in 
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( fT6l l. Note that a fixed-point-free matrix is a paraphrase of a 
matrix having no eigenvalue in ¥ q . 

Lemma 7: Let M be (the transpose of) the companion 
matrix of a polynomial a(x) of degree m > 2 over F 9 that 
has no root in ¥ q . Then, M has no eigenvalue in ¥ q . 

Proof. The characteristic polynomial of M is a(x) itself 
as can be checked by a direct calculation. Hence, M has no 



eigenvalue in F 9 



□ 



The next trivial fact shows that choosing such a polynomial 
a{x) is a task of constant complexity in code-length. 

Lemma 8: Suppose a polynomial bk{x) = x k — a,k-ix k ~ 1 — 

■ ■ - — aix — ao over ¥ q has no root in ¥ q . Then, for any integer 
m > k with m = k (mod q — 1), b m (x) = x m — Ok-iX 

■ ■ ■ — axx — ao has no root in ¥ q . 



k-l 



B. Proof of Lemma \5\ 

Proof of Lemma\5\and its corollaries. We should only prove 
the bound on minimum distance since the other part of the 
proof of [8] is valid for any prime power q. 

Denoting a generator matrix of L /J - by H', we may assume 
H 1 is a submatrix of the generator matrix U of i x . Then, 
since spanH < span £7, we may assume 

H' 

w 



n' 



is a submatrix of the 'stabilizer' matrix H, as shown in [8], 
and hence is a submatrix of Q as well. 

We consider w([u, v]) for x = (u\v) S spanC? \ span7Y', 
noting spanW = L' x © L ,A -. If no rows of (V\MV) are 
involved in the generation of (u\v), then w([u, v}) > d. Note, 
otherwise, u,v E L' \ L lj - and v ^ Xu for any A. Hence, we 
have the lemma. 

Corollary [3] immediately follows from the lemma. We 
establish Corollary 0] by proving d" > f^-d']- Namely, 
we show that for any pair of linearly independent vectors 
u,v € L'\ L f± , we have w([u,v]) > l^d']. Write u = 
(wi, . . . , UjVn), v = . . . , vn ), and put w = w(u). Without 
loss of generality, we may assume u w +i = ■ ■ ■ = Un = 0. 
Denoting the number of i with Vi — Xui, 1 < i < w, by 1(A) 
for A G Fq, we have an element A* G ¥ q with /(A*) > w/q, 
the average of l(X). Then, 



d' < w(v — X*u) < w h w((u. 



W + l J • 



•)«JV„))- 



Hence, we have w([u, v}) = w + w((v w +x, . . . , vn )) > d' + 
w/q > d'(l + 1/q), and the corollary. □ 

C. Proof of Proposition [2] 

In our construction, we apply Lemma [5] assuming the tower 
in (gH) is that in (|49]). Note dimCf = (n - k)/2, which 
follows from that Ci/C 1 ^ - is an [[n, k]] quotient code and C\ = 
Ci, and hence, 

N n = nN, K n = kK+ ?—-^N, 



K' = kK' 



- k 



-N 



where 



K = dim F , D, K' = dim F , D' . 



Hence, the overall rate of the symplectic code is 



K +K' -N kfK + K> 



N 



n V N 



(53) 



Put 



6 = liminf "WW, S ' = liminf \ B) 



N n 



Then, the analysis in Section IXHI that leads to d38l and d39l >. 
which actually lower-bounds the minimum distance of the 
concatenation of Cj/Cj and Dj/{0} — Dj, gives 

5 > -(1 - 7 - R) = A, 5>>-(l-j-R') d ^ f A' 
n n 

where R, R' are the limits appearing in the condition (iii). 
Putting 

R" = R+ R' - 1 and A = A'(q + l)/q, (54) 



we have 



min{5,5'(g + l)/g} > % + (l-2j-R"). 



(2q+l)n 



Then, noting ( |53l and 



K K' 
liminf — > R, liminf — > R 1 \ 

v — *oo v — >oo iv 



which imply 



K + K' 
liminf T -!>#' 



l/—*DO N 

we see the overall rate of the symplectic code satisfies 

Kr*M K ° +K J- N °> k ~R» = R . 

Thus, the constructed [[N Q , K'J, d ]] symplectic codes sat- 
isfy 



K" 

lim inf — f- > R Q 



(55) 



and 



lim mf — > I 7 i? ) (56) 

i/— too N D 2q + 1 V n k / 



by Corollary |4] Note 061 ) can be attained for any rate 

k 



Ro > 



2(q+l)n 



(1-27), 



(57) 



which is a rewriting of R > 1/2. (Given R a , put i?" = nR /k 
and let (i?, i?') be the solution of d54l ); see also the remark to 
the proposition.) 
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D. Proof of Lemma [6] 

We prove this lemma by presenting a procedure for pro- 
ducing generator matrices G n of the [n, n — 1] code C\ of 
properties (A') and (B') for n = 3,4,... recursively. The 
produced matrices G„ will have the parity check vector b in 
the first row. Note F g has the subfield F4 since q = 2 2m for 
some mgMby assumption. Let £ be a primitive element of 
this subfield. The procedure starts with the following generator 
matrix G3, which fulfills (A') and (B'), where C\ = spanG3 
and b equal to the first row of G3: 



G, = 



c e 


1 ■ 


c 2 c 






Step 1 for n — 3. Deleting the last column of G3, pasting 
(0, 0) at the bottom, and pasting an appropriate 3x2 matrix 
on the right, we have 





" c 


c 2 


c 


c 2 


M 4 = 


c 2 


c 
















c 2 


c 



which has the desired properties (A') and (B') for n = 4. 

Step 2 for n = 3. The matrix M4 can be changed, by adding 
a scalar multiple of the first row to the last, into 







c 2 


c 


c 2 


G 4 = 


c 2 


c 










1 


c 


c 






(The change was made so that the entries in the rightmost 
column vanishes except the uppermost entry.) Obviously, this 
generator matrix also has the desired properties. 

For 71 = 4, 5, ... , as well, we can produce M n+ i and then 
G„+i of the desired properties from G„ repeating Steps 1 
and 2, which generalizes for an arbitrary number n > 3. The 
generalization is obvious except the choice of the n x 2 matrix 
in Step 1. This matrix should be the transpose of 

AC ••• c 2 
AC 2 ••• c 

where A is the (1, ?i)-entry of G„, which is needed to make the 
first row of G n +i self-orthogonal. Thus, we have the desired 
generator matrices G„ of [n, n — 1] codes Gi for n > 3. 
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